Microsoft’s choice of the phrase
“Remote Code Execution” in the CVE title for CVE‑2026‑20946 is not a mistake — it’s an operational signal about attacker origin and potential impact — while the CVSS Attack Vector value of
AV:L (Local) is a precise, technical statement about
where the vulnerable code runs at the moment the exploit triggers. These two labels answer different questions and together give defenders the complete risk picture: a remote adversary can deliver a weaponized Excel file, but the vulnerability is triggered when Excel parses that file locally on the endpoint.
Background
Microsoft’s public advisory for CVE‑2026‑20946 lists the issue as an
Excel Remote Code Execution vulnerability. That headline is short, attention‑getting, and designed to communicate the worst‑case outcome: an attacker operating from off‑host can cause code to run on a target if the attack chain completes. CVSS (Common Vulnerability Scoring System), however, breaks exploitability into structured metrics; one of those,
Attack Vector (AV), documents
where the vulnerable code must execute at the moment the exploit is triggered. For document‑parsing bugs in Office products this often ends up as
AV:L, even when the malicious document was delivered over email, cloud storage, or a download link.
This seeming contradiction — “Remote” in the CVE title vs. “Local” in CVSS — is intentional and common for Office document RCEs. Understanding the distinction is essential for accurate triage, risk communication, and mitigation planning.
Overview: Two complementary lenses on the same risk
- The CVE title (“Remote Code Execution”) answers: From where can an attacker operate and what worst‑case capability does the attacker have?
It emphasizes that the attacker can be offsite and may use networked delivery channels to reach potential victims.
- The CVSS Attack Vector (e.g., AV:L) answers: Where must the vulnerable code be executing when the exploit actually takes place?
For typical Excel parsing bugs, the vulnerable logic executes inside the local Excel process when a user opens or previews a spreadsheet — therefore AV:L is the technically correct designation.
Read together, these signals describe a classic attack chain: remote delivery, local trigger, local code execution. That chain is what makes document‑based RCEs both high‑impact and practical for attackers.
Technical anatomy: why “Remote” and “Local” coexist
1) Delivery channel vs. trigger context
Attackers commonly use low‑friction delivery mechanisms — spear‑phishing email attachments, shared cloud links, or web downloads — to get a malicious Excel workbook into a victim’s environment. The
delivery is remote. The
trigger occurs when Excel (a local application) parses the file and hits the vulnerable code path, at which point arbitrary code can run inside the local process. This is the core reason the CVE title emphasizes “Remote” while CVSS records AV:L.
2) CVSS design principle: avoid “double‑counting”
CVSS separates the
delivery phase from the
trigger phase on purpose. The Attack Vector metric captures the locality of the moment the vulnerable code executes — not the path the malicious data took to reach the machine. If the vulnerability triggers inside a local application parsing a file present on disk or in memory, CVSS uses AV:L to preserve consistency across many different kinds of vulnerabilities. That avoids wrongly inflating exploitability by counting both a remote delivery and a remote trigger.
3) Data‑only exploits and native parsers
Excel’s parsing stack is large and complex: legacy BIFF structures, Open XML subdocuments, embedded OLE objects, ActiveX, rendering subsystems, and formula engines. Many of those components are implemented in native C/C++ and have historically harbored memory‑safety issues (use‑after‑free, heap overflows, out‑of‑bounds reads/writes). When attackers control file data, they can sometimes manipulate parser state to corrupt memory and hijack control flow — producing
data‑only RCEs that don’t require macros or scripting. Those are particularly dangerous and are the typical pattern behind Office “RCE” advisories that score AV:L.
The canonical Excel exploit chain (step by step)
- Attacker crafts a malicious Excel workbook (XLSX, XLSB, or embedded object) that targets a memory‑safety flaw.
- Attacker delivers the file remotely through email, cloud share, or a compromised website.
- Victim opens the workbook in local Excel, or a preview handler/rendering service on the endpoint processes it.
- Excel’s parser triggers the memory corruption and attacker code executes inside the local Excel process under the user’s account.
This sequence shows where “remote” refers to the attacker’s
origin and “local” refers to the
execution context when the exploit fires.
The server‑side exception: when AV becomes Network (AV:N)
There is a crucial operational exception that changes the attack vector from Local to Network: if a
network‑accessible server or service (for example, an email gateway that generates attachment previews, Office Online Server, a collaborative cloud document service, or a document conversion service) parses the same vulnerable content on behalf of remote clients, then the vulnerable code executes inside a network‑bound process. In that case the proper CVSS Attack Vector is
AV:N, because a remote attacker can trigger the bug without requiring a user to open a file on their workstation. Advisories explicitly call this out when applicable because it materially increases exposure.
Operational implication: inventory any server‑side parsing or previewing components — those hosts become the highest‑priority patch targets if they use the same code paths as desktop Excel.
Why defenders should not de‑prioritize AV:L RCEs
A CVSS Attack Vector of Local does not mean “hard to exploit” in the real world. Consider these practical realities:
- Ubiquity of Excel — Office is installed across millions of endpoints; crafted spreadsheets can reach many targets quickly.
- Low delivery friction — Email, cloud links, and shared drives make distribution trivial.
- Social engineering is effective — Well‑crafted lures (invoices, shared reports, HR forms) reliably trick users into opening attachments.
Because the exploit often needs only that a user open a file (CVSS: UI:R —
User Interaction required), an AV:L document RCE commonly becomes a high‑impact operational risk and should be treated urgently.
Practical mitigation and triage guidance
Immediate actions (apply first)
- Install Microsoft’s security updates for the affected Excel/Office builds as soon as possible. Patching the vulnerable code is the primary mitigation. Verify the correct KBs and required servicing stack updates before mass deployment.
- Enforce Protected View and keep Office configured to open files from the Internet in a sandboxed view by default. This reduces the chance that parsing proceeds in an unprotected context.
- Harden email gateways: block, quarantine, or sandbox suspicious attachments and restrict attachment types from external senders. Apply attachment scanning and threat intelligence to reduce delivery of weaponized files.
Tactical mitigations (short term)
- Disable automatic previewing of attachments in mail clients and remove preview handlers that use the same vulnerable parsing stack.
- Enforce macro policies: disable macros by default and allow only signed macros from trusted publishers; while macros are not the vector for data‑only exploits, macro restrictions reduce follow‑on stages for many attack chains.
- Apply Endpoint Detection and Response (EDR) rules to detect anomalous Excel process behavior, suspicious child processes, or unusual network activity following document opens.
Longer‑term controls
- Adopt least‑privilege user models so successful exploitation runs with minimized rights.
- Use phishing‑resistant multi‑factor authentication and run phishing awareness programs to reduce the initial delivery success rates.
- Inventory and harden any server‑side services that parse Office documents (mail gateways, preview servers, Office Online/Office Web Apps, cloud collaboration platforms). Prioritize patching these hosts because they can convert AV:L into AV:N exposure.
Triage checklist for IT and security teams
- Identify all Excel and Microsoft 365 Apps builds in use and map them to the vendor’s KBs for CVE‑2026‑20946.
- Immediately schedule patch deployment for high‑risk endpoints and any servers that perform document parsing.
- Temporarily restrict or quarantine Excel attachments from external senders and disable automatic previewing if possible.
- Validate Protected View and Application Guard settings for Office clients.
- Update EDR and SIEM detection rules to hunt for suspicious Excel process activity and follow‑on behaviors.
Critical analysis: strengths and risks in vendor messaging and CVSS usage
Strengths
- Operational clarity: The CVE title’s “Remote Code Execution” label is an effective triage signal that communicates impact and attacker origin succinctly; teams understand this as high‑priority.
- Technical precision: CVSS’s AV metric gives consistent, mechanistic scoring that supports automated prioritization and comparison across many vulnerabilities. The distinction prevents accidental overrating of exploitability.
Risks and sources of confusion
- Headline vs. mechanics mismatch: Teams that ingest only CVE titles (or only CVSS vectors) into automation pipelines can misclassify risk. Titles emphasize impact and attacker origin; CVSS focuses on the exploitation moment. Both are needed for accurate triage.
- Overlooking server‑side parsing: Many organizations miss that a mail gateway, preview service, or document conversion host might run the same parsing code — and therefore be network‑exploitable. Ignoring these services can convert a client AV:L problem into a service AV:N disaster.
- False sense of safety from “Local”: Interpreting AV:L as “low risk” is dangerous. The combination of ubiquitous delivery channels and social engineering makes AV:L document RCEs practical and high‑impact.
Verifiability and cautionary notes
- The general explanation above — that “Remote” in a CVE title refers to attacker origin/delivery and CVSS AV:L refers to the execution context — is canonical and documented in vendor advisories and CVSS guidance. Multiple independent technical analyses and advisories use this framing for Office document‑parsing vulnerabilities.
- Specific details about CVE‑2026‑20946 — such as the precise CVSS v3.1 vector string, affected build numbers, and KB article IDs — should be verified directly against Microsoft’s official advisory for that CVE (Microsoft Security Response Center update guide). If your environment depends on precise KB mappings or needs to confirm whether server‑side components are affected, pull the official MSRC entry in a browser or via your enterprise patch catalog and cross‑check the CVSS vector and remediation steps there. If the MSRC page uses client‑side rendering, automated scrapers may not capture all details; use an interactive browser to confirm specifics. Flag any discrepancy between vendor text and your internal scanners as requiring manual verification.
- If you require the exact CVSS string published by Microsoft for CVE‑2026‑20946, or confirmation about whether the AV is AV:L versus AV:N in your environment, verify the MSRC record and any related Microsoft Knowledge Base articles directly. If those pages are not easily scrapped, rely on vendor update catalogs and your organization’s patch management tools to map KBs to builds.
Visual summary (quick reference)
- CVE title: Remote Code Execution → signals attacker origin (remote actor/delivery) and worst‑case impact (arbitrary code execution).
- CVSS Attack Vector: AV:L → technically indicates the vulnerable code executes locally inside the application process when triggered.
- Practical meaning → An attacker can deliver a malicious spreadsheet remotely; the exploit completes when the target locally opens or previews the file.
Conclusion
The apparent mismatch between Microsoft’s CVE title for CVE‑2026‑20946 (“Remote Code Execution”) and the CVSS Attack Vector value (AV:L) is not an error — it reflects two complementary forms of communication. The CVE title prioritizes operational urgency and attacker origin; CVSS records the technical mechanics of exploitation at the moment the vulnerable code is invoked. For defenders, the takeaway is simple and actionable: treat Excel RCE advisories as high priority even when CVSS lists AV:L, patch promptly, harden user‑facing controls (Protected View, gateway filtering, preview settings), and inventory any server‑side document processing that could convert a client‑only issue into a network‑exploitable problem. Together, these steps reduce the real‑world risk posed by document parsing vulnerabilities and close the window attackers need to weaponize this class of flaws.
Source: MSRC
Security Update Guide - Microsoft Security Response Center